This article provides a comprehensive analysis of two new variants of the KimJongRAT stealer.
Palo Alto Unit 42 combine new research findings with existing knowledge to provide a comprehensive resource for understanding and combating these new KimJongRAT variants. The KimJongRAT stealer was first described in 2013 by the Malware.lu CERT. Palo Alto researchers documented another variant of this family in 2019. One of the new variants uses a Portable Executable (PE) file and the other uses a PowerShell implementation. The PE and PowerShell variants are both initiated by clicking a Windows shortcut (LNK) file that downloads a dropper file from an attacker-controlled content delivery network (CDN) account.
Read more…
Source: Palo Alto Unit 42
Sign up for our Newsletter
The latest news and insights delivered right to your inbox.
Related:
- Hackers can use GitHub Codespaces to host and deliver malware
January 17, 2023
Researchers have demonstrated how threat actors can abuse the GitHub Codespaces’ port forwarding’ feature to host and distribute malware and malicious scripts. GitHub Codespaces allows developers to deploy cloud-hosted IDE platforms in virtualized containers to write, edit, and test/run code directly within a web browser. Read more… Source: Bleeping Computer
- Earth Bogle: Campaigns Target the Middle East with Geopolitical Lures
January 17, 2023
While threat hunting, Trend Micro researchers found an active campaign using Middle Eastern geopolitical themes as a lure to target potential victims in the Middle East and Africa. In this campaign researchers have labeled Earth Bogle, the threat actor uses public cloud storage services such as files.fm and failiem.lv to host malware, while compromised web ...
- Hackers exploit Cacti critical bug to install malware, open reverse shells
January 15, 2023
More than 1,600 instances of the Cacti device monitoring tool reachable over the internet are vulnerable to a critical security issue that hackers have already started to exploit. Cacti is an operational and fault management monitoring solution for network devices that also provides graphical visualization. There are thousands of instances deployed across the world exposed on ...
- Ransomware has now become a problem for everyone, and not just tech
January 15, 2023
It’s a new year, a time when many people look to turnover a new leaf and make some positive changes. Sadly, not everyone. In particular, it seems that ransomware gangs show no signs of letting up on their criminal activity in 2023. Then again, why would they? Read more… Source: ZDNet
- CircleCI’s hack caused by malware stealing engineer’s 2FA-backed session
January 14, 2023
Hackers breached CircleCi in December after an engineer became infected with information-stealing malware that their 2FA-backed SSO session cookie, allowing access to the company’s internal systems. Earlier this month, CircleCi disclosed that they suffered a security incident and warned customers to rotate their tokens and secrets. data thIn a new security incident report on the attack, CircleCi ...
- NortonLifeLock warns that hackers breached Password Manager accounts
January 13, 2023
Gen Digital, formerly Symantec Corporation and NortonLifeLock, is sending data breach notifications to customers, informing them that hackers have successfully breached Norton Password Manager accounts in credential-stuffing attacks. According to a letter sample shared with the Office of the Vermont Attorney General, the attacks did not result from a breach on the company but from account ...